Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-3935: Mosquitto broker can crash if bridge uses topic remapping

CVE-2024-3935 · published 2 years ago

Summary

Versions 2.0.0 through 2.0.18 of Mosquitto can stop working when a bridge connection is set up with topic remapping and receives a specially crafted message. The broker may crash, interrupting service. Update Mosquitto to a newer release or remove the bridge topic‑remapping configuration to avoid the problem.

What to do

Update alpine rootio-mosquitto to version 2.0.18-r00074.
Update alpine rootio-mosquitto to version 2.0.18-r00072.
Update mosquitto to version 2.0.18-r00075.
Update rootio-mosquitto to version 2.0.18-r00075.
Update debian mosquitto to version 2.0.11-1.2+deb12u2.
Update debian mosquitto to version 2.0.20-1.
Update eclipse mosquitto to version 2.0.19 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	eclipse	mosquitto	>= 2.0.0, < 2.0.19 `cpe:2.3:a:eclipse:mosquitto::::::::`
Root:Alpine:3.20	alpine	rootio-mosquitto	< 2.0.18-r00074 < 2.0.18-r00072 Fix: upgrade to 2.0.18-r00074
Root:Alpine:3.18	alpine	rootio-mosquitto	< 2.0.18-r00074 Fix: upgrade to 2.0.18-r00074
Root:Alpine:3.19	alpine	rootio-mosquitto	< 2.0.18-r00074 Fix: upgrade to 2.0.18-r00074
Root:Alpine:3.20	–	mosquitto	< 2.0.18-r00075 Fix: upgrade to 2.0.18-r00075
Root:Alpine:3.20	–	rootio-mosquitto	< 2.0.18-r00075 Fix: upgrade to 2.0.18-r00075
Debian:12	debian	mosquitto	< 2.0.11-1.2+deb12u2 Fix: upgrade to 2.0.11-1.2+deb12u2
Debian:13	debian	mosquitto	< 2.0.20-1 Fix: upgrade to 2.0.20-1

Original advisory text

Eclipse Mosquito: Double free vulnerability

In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connection has an incoming topic configured that makes use of topic remapping, then if the remote connection sends a crafted PUBLISH packet to the broker a double free will occur with a subsequent crash of the broker.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/3xxx/CVE-2024-3935.j... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-3935 Vendor Advisory
https://github.com/eclipse/mosquitto Product
https://lists.debian.org/debian-lts-announce/2025/02/msg00022.html URL
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/197 Third Party Advisory
https://github.com/eclipse-mosquitto/mosquitto/commit/ae7a804dadac8f2aaedb24336d... Patch
https://mosquitto.org/blog/2024/10/version-2-0-19-released/ Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2024-3935 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

8.1 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-415Double Free

Timeline

Published30 Oct 2024

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2024-3935 · NVD

ROOT-OS-ALPINE-318-CVE-2024-3935 · OSV

ROOT-OS-ALPINE-320-CVE-2024-3935 · OSV

ROOT-OS-ALPINE-319-CVE-2024-3935 · OSV

CVE-2024-3935 · OSV

DEBIAN-CVE-2024-3935 · OSV

Track software like this

Free during beta